| The "Delete" action for comments and annotations (AnnotationCode.Macros#displayAnnotationToolboxFromReference,
and the equivalent in flamingo's commentsinline.vm) is a plain `<a href="...">` link to the `objectremove`
action, gated only by a confirmation modal (Bootstrap `#deleteModal`) whose confirm button navigates the
browser to that link's href. The link itself performs the actual mutation (deleting the comment/annotation
object) as a simple GET-style navigation, protected only by a `form_token` carried in the query string. This was flagged during review of PR #5928 (https://github.com/xwiki/xwiki-platform/pull/5928#discussion_r3735753256):
using a link to modify server-side state is bad practice; a proper HTML `<form method="POST">` should be
used instead. The reviewer noted this pattern is already used pervasively across the codebase (comments,
annotations, and elsewhere), so it's a pre-existing issue, not something introduced by that PR - it should be
tracked and fixed on its own rather than folded into an unrelated UI-focused PR. Proposed fix: convert the Delete confirmation flow to submit a real POST form (hidden inputs for
`form_token`, `classname`, `classid`, `xredirect`) instead of navigating a plain link, for both the
annotation toolbox (AnnotationCode.Macros) and the standard Comments viewer (commentsinline.vm) delete
actions. Worth checking whether other state-mutating links in the same areas (e.g. the annotation Edit
action, which navigates to a save/edit URL) should be reconsidered at the same time. |
